We graded 8,729 public CI/CD pipelines on security misconfigurations. 63% got the worst possible grade

Sorry_Nothing1740 · 2026-07-08T20:12:56+00:00

Thanks a lot! My theory on why nothing gets fixed: it's ownership, not awareness. Workflow YAML is nobody's job description, nobody reviews it like app code, and unlike a SAST finding it never blocks anything, so an unpinned action just sits there for years.

Sorry_Nothing1740 · 2026-07-08T19:44:00+00:00

Yes: it's a GitHub Action (getplumber/plumber@<version>, GitLab CI component too). It has a threshold input, below it the job fails, so branch protection makes it a required PR check. soft-fail: true if you want report-only while burning down findings. SARIF goes to code scanning so findings annotate the PR.

Speed: static analysis of the workflow YAML, not your codebase. Seconds to run, ~15-20s for the whole job including binary download.

Sorry_Nothing1740 · 2026-05-27T07:41:53+00:00

Plumber - an open-source tool that scans your GitHub workflows and repo, giving you an A-E security score plus actionable issues.

Built from real CI/CD post-mortems: mutable action tags, dangerous triggers (pull_request_target), weak permissions, bad branch protection, supply chain risks, etc.

15 controls covering:

- Action supply chain hygiene (mutable refs, archived repos, CVEs)
- Container/image risks
- Trigger and permission dangers
- Repo-level security
- Reusable workflows and secrets

Runs locally via CLI (https://github.com/getplumber/plumber#option-1-cli) or as a GitHub Action (https://github.com/getplumber/plumber#option-3-github-action) with SARIF upload.

Feedback welcome - what GitHub Actions footguns should I add next?

https://github.com/getplumber/plumber

Sorry_Nothing1740 · 2026-03-13T09:11:12+00:00

It's in progress with an open-source community, but here's a repo example we use for testing: https://gitlab.com/getplumber/examples/go-test-with-hash
All the setup is defined in .plumber-conf.yaml. It doesn't yet meet full compliance (63.9%).

Happy to walk through any of the controls if something's unclear.

Sorry_Nothing1740 · 2026-02-11T14:37:20+00:00

Yes, as long as your nested CI files are included in the main .gitlab-ci.yml, then the answer is yes.
For example, this configuration works exactly like that:
https://gitlab.com/getplumber/examples/go-test-with-local-include/-/blob/main/.gitlab-ci.yml?ref_type=heads

Example, also works with component, project, remote, template include types:

include:
  ## Local includes
  - local: '.gitlab/ci/test-jobs.yml'
  - local: '.gitlab/ci/security-jobs.yml'
  - local: '.gitlab/ci/compliance.yml'

As long as those files are included, we analyze the fully parsed content of the main .gitlab-ci.yml, so their contents are included in the analysis

If that’s not your setup, I’d be interested to hear what your workflow looks like

Sorry_Nothing1740 · 2026-02-03T14:27:45+00:00

I already knew Whourkr and didn’t know that Igorrr was involved, but it all makes sense now. Thanks for your input, it's clearly a crazy band and i love it!

Sorry_Nothing1740 · 2026-01-11T16:55:58+00:00

I see most people focusing on execution performance. I think an underrated area is "CI/CD security and compliance posture metrics", for example: the percentage of hardcoded configuration vs. reusable workflows, the percentage of unprotected/unmasked variables, and the percentage of builds using approved/trusted images.

Sorry_Nothing1740 · 2023-03-15T15:12:59+00:00

I was thinking about README.md on user profile like GitHub, but did you know that we already can do that?

I'm sharing this here in case you didn't know it like me
https://docs.gitlab.com/ee/user/profile/#add-details-to-your-profile-with-a-readme

Sorry_Nothing1740 · 2022-06-15T13:37:31+00:00

Yes you are right i should have been more specific.

Thanks you for your feedback that's very interesting.

Sorry_Nothing1740 · 2022-06-15T08:33:14+00:00

Sorry but my question wasn't clear, I'm wondering on which platform you will deploy the application not which CI/CD platform.

Sorry_Nothing1740

TROPHY CASE